diff options
| author | Konstantin Meskhidze <konstantin.meskhidze@huawei.com> | 2023-09-05 12:59:14 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2023-09-23 11:48:12 +0300 |
| commit | 8069aebe90313a71849a2171ed72354e279a8069 (patch) | |
| tree | c6ff1e3c94747d41019745f0ce58d2b5744ca259 /scripts | |
| parent | 9c9362a2af2ac8302c912e1fc09dc6da0063b9f6 (diff) | |
| download | linux-8069aebe90313a71849a2171ed72354e279a8069.tar.xz | |
kconfig: fix possible buffer overflow
[ Upstream commit a3b7039bb2b22fcd2ad20d59c00ed4e606ce3754 ]
Buffer 'new_argv' is accessed without bound check after accessing with
bound check via 'new_argc' index.
Fixes: e298f3b49def ("kconfig: add built-in function support")
Co-developed-by: Ivanov Mikhail <ivanov.mikhail1@huawei-partners.com>
Signed-off-by: Konstantin Meskhidze <konstantin.meskhidze@huawei.com>
Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'scripts')
| -rw-r--r-- | scripts/kconfig/preprocess.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/scripts/kconfig/preprocess.c b/scripts/kconfig/preprocess.c index 8c7e51a6273c..0b0d6ed3eeb9 100644 --- a/scripts/kconfig/preprocess.c +++ b/scripts/kconfig/preprocess.c @@ -393,6 +393,9 @@ static char *eval_clause(const char *str, size_t len, int argc, char *argv[]) p++; } + + if (new_argc >= FUNCTION_MAX_ARGS) + pperror("too many function arguments"); new_argv[new_argc++] = prev; /* |